Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
29-10-2021 10:26
Static task
static1
Behavioral task
behavioral1
Sample
pvRnUbWwToDTcwg.exe
Resource
win7-en-20211014
General
-
Target
pvRnUbWwToDTcwg.exe
-
Size
519KB
-
MD5
8e07e2f350449f748eb0d1a9cde22180
-
SHA1
6e453492ae09c770dd23bc4836c53b7bf7d505d0
-
SHA256
f83cdf1780fcb5525b353125751e8495c5d372d6fbd341b06a60f05ac2de2160
-
SHA512
8d730e1ae09b47e64a8a1c1e522f3bb7f1a50d1e27436bdd45ecb56348433c8605f0e668d09c2bf9b65a275b7426c31ab2afb6579119db007a7787079128fdfb
Malware Config
Extracted
formbook
4.1
pn4r
http://www.wexchange.money/pn4r/
mymicroreader.com
rpttoday.com
covid-testiranje.com
trendismon.com
xtoearn.com
themiraclemamma.com
reebok-technology.store
naionics.com
nuatierra.com
tarynrenee.com
tessstrachey.xyz
ptarmigan.xyz
publistom.com
hostingforyou.online
padellacentral.com
vp0y0x.icu
theultimatewhisper.com
fashionbrandsweek.com
soltechwebdesign.site
proteinakua.net
armc.site
votek.online
semrushservers.online
sidejobmillionaire.com
elbebedigital.com
moradassiri.com
wvvw-poloniex-loginscom.com
ragamuffinprims.com
first-coach.fr
qpphha085.xyz
athleisurehype.com
visitbariloche.com
communityenablers.com
theinternetblogger.com
ventalista.club
icsasociosconsultores.com
liveinthemou.com
houstonlaboratory.com
opreaigor.com
flipurrealestate.com
mrdics.com
bikathlon.com
theelfclub.club
aizhengyo.com
making-wealth.com
pahotline.com
mandjhairsolutions.com
smartcpdonline.com
venosmine.com
artasiafox.com
pr-casting.com
25iaku.icu
cashinonquitting.com
filicebrown.com
eo88t0.icu
sj236.com
ddassc.icu
forexminingtrading.com
wowbestproduct.com
shopspaceboots.com
registersure.com
sedukapug.rest
theperfectbussines.com
elegantaesthetics.biz
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4580-124-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4580-125-0x000000000041F110-mapping.dmp formbook behavioral2/memory/4492-132-0x0000000000810000-0x000000000083F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
pvRnUbWwToDTcwg.exepvRnUbWwToDTcwg.execscript.exedescription pid process target process PID 760 set thread context of 4580 760 pvRnUbWwToDTcwg.exe pvRnUbWwToDTcwg.exe PID 4580 set thread context of 2712 4580 pvRnUbWwToDTcwg.exe Explorer.EXE PID 4492 set thread context of 2712 4492 cscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
pvRnUbWwToDTcwg.execscript.exepid process 4580 pvRnUbWwToDTcwg.exe 4580 pvRnUbWwToDTcwg.exe 4580 pvRnUbWwToDTcwg.exe 4580 pvRnUbWwToDTcwg.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe 4492 cscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2712 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
pvRnUbWwToDTcwg.execscript.exepid process 4580 pvRnUbWwToDTcwg.exe 4580 pvRnUbWwToDTcwg.exe 4580 pvRnUbWwToDTcwg.exe 4492 cscript.exe 4492 cscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
pvRnUbWwToDTcwg.execscript.exedescription pid process Token: SeDebugPrivilege 4580 pvRnUbWwToDTcwg.exe Token: SeDebugPrivilege 4492 cscript.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
pvRnUbWwToDTcwg.exeExplorer.EXEcscript.exedescription pid process target process PID 760 wrote to memory of 4580 760 pvRnUbWwToDTcwg.exe pvRnUbWwToDTcwg.exe PID 760 wrote to memory of 4580 760 pvRnUbWwToDTcwg.exe pvRnUbWwToDTcwg.exe PID 760 wrote to memory of 4580 760 pvRnUbWwToDTcwg.exe pvRnUbWwToDTcwg.exe PID 760 wrote to memory of 4580 760 pvRnUbWwToDTcwg.exe pvRnUbWwToDTcwg.exe PID 760 wrote to memory of 4580 760 pvRnUbWwToDTcwg.exe pvRnUbWwToDTcwg.exe PID 760 wrote to memory of 4580 760 pvRnUbWwToDTcwg.exe pvRnUbWwToDTcwg.exe PID 2712 wrote to memory of 4492 2712 Explorer.EXE cscript.exe PID 2712 wrote to memory of 4492 2712 Explorer.EXE cscript.exe PID 2712 wrote to memory of 4492 2712 Explorer.EXE cscript.exe PID 4492 wrote to memory of 4552 4492 cscript.exe cmd.exe PID 4492 wrote to memory of 4552 4492 cscript.exe cmd.exe PID 4492 wrote to memory of 4552 4492 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pvRnUbWwToDTcwg.exe"C:\Users\Admin\AppData\Local\Temp\pvRnUbWwToDTcwg.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pvRnUbWwToDTcwg.exe"C:\Users\Admin\AppData\Local\Temp\pvRnUbWwToDTcwg.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\pvRnUbWwToDTcwg.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/760-117-0x0000000005860000-0x0000000005861000-memory.dmpFilesize
4KB
-
memory/760-118-0x0000000005400000-0x0000000005401000-memory.dmpFilesize
4KB
-
memory/760-119-0x0000000005380000-0x0000000005381000-memory.dmpFilesize
4KB
-
memory/760-120-0x00000000056C0000-0x00000000056C6000-memory.dmpFilesize
24KB
-
memory/760-121-0x0000000005360000-0x000000000585E000-memory.dmpFilesize
5.0MB
-
memory/760-122-0x0000000007100000-0x0000000007101000-memory.dmpFilesize
4KB
-
memory/760-123-0x00000000071A0000-0x00000000071F0000-memory.dmpFilesize
320KB
-
memory/760-115-0x0000000000AC0000-0x0000000000AC1000-memory.dmpFilesize
4KB
-
memory/2712-129-0x00000000026C0000-0x0000000002782000-memory.dmpFilesize
776KB
-
memory/2712-136-0x0000000005500000-0x0000000005638000-memory.dmpFilesize
1.2MB
-
memory/4492-133-0x0000000004A90000-0x0000000004DB0000-memory.dmpFilesize
3.1MB
-
memory/4492-130-0x0000000000000000-mapping.dmp
-
memory/4492-131-0x0000000001320000-0x0000000001347000-memory.dmpFilesize
156KB
-
memory/4492-132-0x0000000000810000-0x000000000083F000-memory.dmpFilesize
188KB
-
memory/4492-135-0x00000000047F0000-0x0000000004883000-memory.dmpFilesize
588KB
-
memory/4552-134-0x0000000000000000-mapping.dmp
-
memory/4580-127-0x00000000015D0000-0x00000000018F0000-memory.dmpFilesize
3.1MB
-
memory/4580-128-0x0000000001590000-0x00000000015A4000-memory.dmpFilesize
80KB
-
memory/4580-125-0x000000000041F110-mapping.dmp
-
memory/4580-124-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB